ATTACHMENT B 


Properly lo be seized 

1. All documents and records relating to violations of 18 U.S.C. § 793, 
involving REALITY LEIGH WINNER and occurring after January 1,2013, including: 

a. Classified material; 

b. Any U.S. Government material: 

c. Contacts, by any means, with foreign governments, foreign powers, or 
agents of foreign powers; 

d. Contacts, by any means, w ith media outlets: 

e. Information, including communications in any form, regarding the 
retrieval, storage, or transmission of sensitive or classified material; 

f. Records of travel, including calendars, travel tickets, receipts, and 
photographs; 

g. Information regarding tradecraft. how to obtain or deliver sensitive 
information, and/or how to avoid or evade detection by intelligence officials or law 
enforcement authorities; 

h. Financial records, including bank statements, account information and 
records of any financial transaction; 

i. Information relevant to a motive for the offense, such as anti-government 
statements, propaganda, research, and solicitations or offers to engage in anti-government 
or unlawful activities. 

2. Computers or storage media used as a means to commit the violations described 
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above. 


3. For any computer or storage medium whose seizure is otherwise authorized by 
this warrant, and any computer or storage medium that contains or in which is stored records or 
information that is otherwise called for by this warrant (hereinafter, "COMPUTER”): 

a. evidence of who used, owned, or controlled the COMPUTER at the time the 
things described in this warrant were created, edited, or deleted, such as logs, 
registry entries, configuration files, saved usernames and passwords, documents, 
browsing history, user profiles, email, email contacts, “chat,” instant messaging 
logs, photographs, and correspondence: 

b. evidence of software that would allow others to control the COMPUTER, such as 
viruses, Trojan horses, and other forms of malicious software, as well as evidence 
of the presence or absence of security software designed to detect malicious 
software: 

c. evidence of the lack of such malicious software: 

d. evidence indicating how and when the computer was accessed or used to 
determine the chronological context of computer access, use. and events relating 
to crime under investigation and to the computer user: 

e. evidence indicating the computer user's state of mind as it relates to the crime under 

investigation; 

f. evidence of the attachment to the COMPUTER of other storage devices or similar 
containers for electronic evidence; 
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g. evidence of counter-forensic programs (and associated data) that are designed to 
eliminate data from the COMPUTER; 

h. evidence of the times the COMPUTER was used: 

i. passwords, encryption keys, and other access devices that may be necessary to 
access the COMPUTER; 

j. documentation and manuals that may be necessary to access the COMPUTER or 
to conduct a forensic examination of the COMPUTER; 

k. records of or information about Internet Protocol addresses used by the 
COMPUTER; 

l. records of or information about the COMPUTER’S Internet activity, including 
firewall logs, caches, browser history and cookies, “bookmarked” or “favorite” 
web pages, search terms that the user entered into any Internet search engine, and 
records of user-typed web addresses; 

m. contextual information necessary to understand the evidence described in this 
attachment. 

4. Routers, modems, and network equipment used to connect computers to the 
Internet. 

As used above, the terms “records” and "information” includes all forms of creation or 
storage, including any form of computer or electronic storage (such as hard disks or other media 
that can store data); any handmade form (such as writing); any mechanical form (such as printing 
or typing); and any photographic form (such as microfilm, microfiche, prints, slides, negatives. 
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videotapes, motion pictures, or photocopies). 

The term “documents” means records, notes, letters, correspondence, forms, financial 
records, checks, ledgers, accounting papers, computer printouts, saved e-mail, information on 
computer hard drives and disks, computer input and output reports, and writings, and any other 
item of any type that conveys information. 

The term “computer” includes all types of electronic, magnetic, optical, electrochemical, 
or other high speed data processing devices performing logical, arithmetic, or storage functions, 
including desktop computers, notebook computers, mobile phones, tablets, server computers, and 
network hardware. 

The term “storage medium” includes any physical object upon which computer data can 
be recorded. Examples include hard disks, RAM, floppy disks, flash memory, CD-ROMs, and 
other magnetic or optical media. 
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